CVE-2026-20801

Executive Summary

CVE-2026-20801 is a cleartext transmission vulnerability (CWE-319) affecting Gallagher's integrations with Hanwha VMS and NxWitness VMS. An unauthenticated attacker with local network access can sniff unencrypted video streams, leading to unauthorized viewing of live surveillance footage. The vulnerability has a CVSS score of 5.6 (Medium) and currently has no public exploit code or PoC. The vendor has released patches for both affected integrations.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects proprietary VMS integration software from Gallagher. No OSV or GitHub advisory data is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.6 (Medium)
• Attack Vector (AV): Adjacent Network (AV:A) – attacker must be on the same local network segment.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component is the only affected asset.
• Confidentiality Impact: High (C:H) – full exposure of live video streams.
• Integrity Impact: None (I:N) – data cannot be modified.
• Availability Impact: None (A:N) – service availability is not affected.

Threat Level: Medium. The attack requires local network access, but the impact is high due to the exposure of sensitive surveillance video. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the communication channel between Gallagher's integration components and the Hanwha/NxWitness VMS systems. The integration software transmits live video streams over the network without encryption (cleartext). This allows any unprivileged user with access to the local network to capture and view the video data using network sniffing tools.

Root Cause: The integration software fails to enforce TLS/SSL encryption for video stream transmission. The video data is sent over protocols like RTSP or HTTP without encryption, making it susceptible to passive eavesdropping.

Attack Scenario:

1. An attacker gains access to the local network (e.g., via compromised IoT device, rogue access point, or physical access).
2. The attacker uses a packet sniffer (e.g., Wireshark, tcpdump) to capture network traffic.
3. The attacker filters for video stream traffic (e.g., RTSP, RTP, or HTTP streams).
4. The attacker reconstructs the video stream and views live surveillance footage.

Affected Components:

• Gallagher NxWitness VMS integration (all versions prior to 9.10.017)
• Gallagher Hanwha VMS integration (all versions prior to 9.10.025)

Vulnerable vs. Patched Code

Since this is a proprietary software vulnerability, no source code is publicly available. However, the fix involves enforcing TLS/SSL encryption for all video stream transmissions.

Vulnerable Behavior:

• Video streams are transmitted over unencrypted protocols (e.g., RTSP, HTTP).
• No certificate validation or encryption handshake is performed.

Patched Behavior:

• All video stream transmissions are encrypted using TLS/SSL.
• The integration software validates certificates and refuses to transmit over unencrypted channels.

Example Configuration Change (Hypothetical):

# Vulnerable configuration (cleartext)
video_stream_protocol = rtsp://camera_ip:554/stream

# Patched configuration (encrypted)
video_stream_protocol = rtsps://camera_ip:8322/stream

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the same local network as the vulnerable Gallagher integration.
• A machine with network sniffing tools (e.g., Kali Linux, Wireshark, tcpdump).

Step-by-Step Exploitation:

1. Identify the target: Scan the local network for hosts running Gallagher integration services (e.g., ports 554, 80, 8080).

   nmap -p 554,80,8080 192.168.1.0/24
   

2. Capture network traffic: Start a packet capture on the network interface.

   sudo tcpdump -i eth0 -w capture.pcap
   

3. Filter for video streams: Use Wireshark to filter for RTSP or RTP traffic.

   tshark -r capture.pcap -Y "rtsp or rtp"
   

4. Reconstruct video stream: Use tools like rtspdump or ffmpeg to reconstruct the video.

   ffmpeg -i rtsp://target_ip:554/stream -vcodec copy output.mp4
   

Note: No public exploit code is available. The above steps demonstrate the general technique for exploiting cleartext video streams.

Blue Team

Detection:

• Monitor for unauthorized network sniffing tools (e.g., tcpdump, Wireshark) on the network.
• Detect unusual RTSP/RTP traffic patterns or large data transfers from VMS servers.
• Use network segmentation to isolate VMS traffic from untrusted hosts.

Hunting:

• Search for cleartext video stream protocols (RTSP, HTTP) in network logs.
• Look for connections to VMS servers from unexpected IP addresses.
• Check for unencrypted video streams using protocol analysis tools.

Lab Setup:

• Deploy a test environment with a vulnerable Gallagher integration (version < 9.10.017).
• Set up a monitoring station with Wireshark to capture traffic.
• Simulate an attacker machine on the same VLAN to demonstrate the vulnerability.

Indicators of Compromise (IOCs)

• Network Traffic:

  • Unencrypted RTSP streams (port 554) from Gallagher integration servers.
  • HTTP traffic containing video data (MIME type video/*).
  • RTP packets without encryption (no SRTP/SDES).

• Logs:

  • VMS logs showing connections from unexpected IP addresses.
  • Firewall logs showing large data transfers on ports 554 or 80.

• File Hashes (Hypothetical):

  • Vulnerable integration binary: sha256: a1b2c3d4e5f6...
  • Patched integration binary: sha256: f6e5d4c3b2a1...

• YARA Rule:

  rule Detect_Cleartext_Video_Stream {
      meta:
          description = "Detects unencrypted video stream traffic in PCAP files"
          author = "Valters IT"
          date = "2026-01-01"
      strings:
          $rtsp = "RTSP/1.0" ascii
          $rtp = "$" ascii // RTP marker byte
          $video_mime = "video/" ascii
      condition:
          any of ($rtsp, $rtp, $video_mime)
  }
  

Detection Engineering

YARA Rule

rule Detect_Gallagher_Cleartext_Video {
    meta:
        description = "Detects cleartext video stream traffic from Gallagher integrations"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-20801"
    strings:
        $rtsp_describe = "DESCRIBE rtsp://" ascii
        $rtsp_setup = "SETUP rtsp://" ascii
        $rtp_header = { 80 60 00 01 } // Example RTP header pattern
        $gallagher_ua = "Gallagher" ascii nocase
    condition:
        any of ($rtsp_describe, $rtsp_setup, $rtp_header) and $gallagher_ua
}

Sigma Rule

title: Cleartext Video Stream from Gallagher Integration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unencrypted RTSP/RTP traffic from Gallagher VMS integrations
author: Valters IT
date: 2026-01-01
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        service: "rtsp"
        protocol: "tcp"
        destination_port: 554
    condition: selection
falsepositives:
    - Legitimate unencrypted RTSP streams (should be rare)
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 554 (msg:"CVE-2026-20801 - Cleartext RTSP Video Stream from Gallagher Integration"; flow:to_server,established; content:"DESCRIBE rtsp://"; nocase; content:"Gallagher"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Gallagher NxWitness VMS integration 9.10.017 or later.
2. Upgrade to Gallagher Hanwha VMS integration 9.10.025 or later.
3. If patching is not immediately possible, segment the network to restrict access to the VMS integration servers.
4. Enable network encryption (TLS/SSL) for all video stream transmissions.

Long-Term Mitigations:

• Implement network segmentation (VLANs) to isolate VMS traffic from untrusted hosts.
• Use VPNs or IPsec for remote access to VMS systems.
• Deploy network intrusion detection systems (NIDS) to monitor for cleartext video streams.
• Conduct regular vulnerability scans and penetration tests on VMS infrastructure.
• Enforce least privilege access controls on the network.

Workarounds (if patching is delayed):

• Disable the integration temporarily if not critical.
• Use firewall rules to restrict access to the integration servers to only trusted IP addresses.
• Monitor network traffic for any unauthorized access attempts.

Valters IT